Check this add-on https://splunkbase.splunk.com/app/2757/ More info about the add-on here: https://splunk.paloaltonetworks.com/upgrade.html ... View more

Hi @saeed, in this case, inserting  frozenTimePeriodInSecs in the "pa" index definition (in indexes.conf) you override the default value and you give the value you want only to this index. Ciao and happy splunking. Giuseppe ... View more

@General_Talos  Could u please explain how can I do it with Splunk API? ... View more

Hi @saeed, You should set maxTotalDataSizeMB and frozenTimePeriodInSecs values. maxTotalDataSizeMB should be calculated based on daily ingestion raw GB using below formula; maxTotalDataSizeMB = DailyGB * 1024 * 180 / IndexerCount If your index is ingesting 100GB/day raw data. maxTotalDataSizeMB = 100 * 1024 * 180 / 3   maxTotalDataSizeMB = 6144000   frozenTimePeriodInSecs should be calculated based on retention days; frozenTimePeriodInSecs = 86400 * RetentionMonths * 30 frozenTimePeriodInSecs = 86400 * 6 * 30   frozenTimePeriodInSecs = 15552000   More info can be found in below link; https://docs.splunk.com/Documentation/Splunk/8.1.1/Indexer/Setaretirementandarchivingpolicy#Set_attributes_for_cold_to_frozen_rolling_behavior   If this reply helps you an upvote is appreciated. ... View more

Thanks a lot ... View more

Thanks a lot       ... View more